Highly advanced worm for sabotage nuclear facilities

A few days ago, it was reported that the Stuxnet worm attacked Heysham Power Station, a nuclear power station in UK. One of two reactors at Heysham 1, owned by the French energy company, EDF. However, as quoted from TheRegister, an EDF spokesperson said “I can confirm that on Heysham 1 there is no Siemens S7 equipment in any safety-related applications. And there is absolutely no link between the cause of Heysham 1’s trip yesterday and any ‘cyber security’ issues”.

Heysham Power Station (img: Wikipedia)

Stories about Stuxnet never end. Since its emergence in June 2010, Stuxnet continues to be a subject of debate among analysts around the world.

Stuxnet is designed to attack specific systems of SCADA and PLCs (Programmable Logic Controllers), which use Siemens STEP 7 SCADA or SIMATIC WinCC. It was also reported that Stuxnet is able to steal sensitive data from the infected systems. SCADA or Supervisory Control and Data Acquisition system is in charge of controlling and monitoring industrial processes and infrastructure, which is also used by the power plants.

Stuxnet really can be described as the most sophisticated worm with very complex code.  Many researchers say that Stuxnet was created by a group of people with technological support and financial resources. The issue has now led to speculation that Stuxnet has been backed by a national government.

Iran has the highest attack rate of the Stuxnet worm. Many people suspect that Stuxnet is designed to attack nuclear power plants in Bushesr, Iran. There is also speculation that Stuxnet intended to attack the uranium centrifuges in Natanz, also in Iran.

(img: energia.gr)

According to latest reports by Symantec, as reported by Reuters, this attack was intended for Iran’s nuclear plants. Meanwhile, Iran had previously issued a confirmation that Stuxnet has infected 30,000 PCs in the country, but have denied that the worm had caused any significant damage or infiltrated the SCADA systems, or the reactors.  Also, Ramin Mehmanparast, a Foreign Ministry spokesman for Iran, believes Stuxnet is part of a Western state sabotage against its nuclear program, but experts see few signs of major damage caused to Iranian facilities, as posted on the site of Ministry of Foreign Affairs. This speculation has now led to a political issue.

Now let us see from the Indonesian side, which is the country with the highest Stuxnet attack rate after Iran. The question then is, why is Stuxnet so widespread in Indonesia? Is Stuxnet also targeted for infrastructure of industry in Indonesia? Until now there has been no confirmation from industry or local governments regarding the impact of this Stuxnet attack. But many reports from general users say that their computer has been infected by the Stuxnet worm.

What has happened in Indonesia is, the use of portable storage media like flash drives act as a medium for data exchange. This could answer the question why Stuxnet is so widespread there, because, as we’ve said in the previous posts, Stuxnet is the first worm that can exploit the Windows operating system through a .LNK file or a shortcut vulnerability (CVE-2010-2568), which is designed to infect the flash drives as the primary media distribution. And not only that, because it can also be spread on the LAN by exploiting the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability (CVE-2008-4250), the Printer Spooler vulnerability (CVE-2010-2729), even using stolen certificates.

In the initial report, Michael Krampe, Siemens spokesperson, said “Siemens was found 15 customer positive infected by this worm, and each able to remove the worm, and no negative impact on their operations”. Another source added, one third came from industry in Germany. Siemens on its official website, provides secure solutions relating to use of their systems, and suggest to avoid the use of flash drives.

With a clear target of attacks that focused on Siemens SCADA systems, it has led to much speculation- and has even led to Iran’s nuclear power plants. Sure, there is a lot of speculation, and many questions are unanswered, but still no one knows who the main target of Stuxnet was, or who created it. In spite of it all, any industry could potentially be attacked by this worm.